forensicsProhard
Drakosha Ali
hackerlab
Task: Modified Kali Linux ISO with encrypted flag file and hidden AES key. Solution: Timestamp analysis to find all modified files, extract AES key/IV from custom kernel module description field, decrypt flag with AES-128-CBC.
$ ls tags/ techniques/
aesaes_cbclinux_kernelsquashfskernel_moduleiso_forensicshash_verificationkali_linuxtimestamp_analysis
iso_integrity_checkmd5_verificationsquashfs_extractiontimestamp_filteringkernel_module_stringsaes128_cbc_decryption
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [misc][Pro]Олег, зачем?— hackerlab
- [forensics][Pro]Скрытый след (Hidden Trail)— hackerlab
- [forensics][Pro]Colonel— tamuctf
- [hardware][free]Defusal— hackthebox
- [forensics][Pro]Матрешка (Matreshka)— hackerlab